246045 matches found
CVE-2026-89864 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound i2c-length in I2C bsg handlers struct qlai2caccess carries a 16-bit length field alongside a fixed 64-byte buffer: struct qlai2caccess uint16t device, offset, option, length; uint8t buffer0x40; packed;...
CVE-2026-89865 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...
CVE-2026-89863 scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...
CVE-2026-89862 scsi: qla2xxx: Fix BSG job leak on validate flash image error path
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...
CVE-2026-89860 scsi: qla2xxx: Initialize NVMe abort_work once at submission
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Initialize NVMe abortwork once at submission qlanvmefcpabort and qlanvmelsabort ran INITWORK on priv-abortwork immediately before schedulework. INITWORK reinitializes the workstruct, resetting its list head and...
CVE-2026-89861 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vport reference in qla24xxreportidacquisition In the format 1 path, the virtual port is located on ha-vplist while holding vportslock, but the lock is dropped before vp is used: qlaupdatehostmap is called and...
CVE-2026-89859 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...
CVE-2026-89858 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...
CVE-2026-89857 scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qlanvmelsrejectiocb allocates from and advances the request ring through qla2x00allociocbs which assumes the hardwarelock is held and qla2x00startiocbs which advances the...
CVE-2026-89856 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is u16, but ha-maxreqqueues, ha-maxrspqueues and ha-maxqpairs are u8. Deriving the queue count as "ha-maxreqqueues = ha-msixcount - 1" therefore...
CVE-2026-89855 scsi: qla2xxx: Serialize flash version read in reset handler
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize flash version read in reset handler The "update cache versions without reset" sysfs reset operation 0x20261 calls getflashversion, which reads hardware flash registers, without holding ha-optrommutex. The...
CVE-2026-89854 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xxputchip drops the last reference to ha-cs84xx and frees it via qla84xxchiprelease without clearing ha-cs84xx. During teardown it ran before scsiremovehost, which is...
CVE-2026-89853 scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...
CVE-2026-89852 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...
CVE-2026-89851 scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace enable parsing in debugfs qla2x00dfsfcewrite called kstrtoul with a NULL result pointer, so a successful parse would dereference NULL and oops. Worse, the int return value 0 on success, negative errno...
CVE-2026-89850 scsi: qla2xxx: Don't query firmware state while chip is down
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Don't query firmware state while chip is down qla2x00fwstateshow initializes rval to QLAFUNCTIONFAILED and jumps to the out: label when the chip is down or EEH is busy. The out: block then re-issued...
CVE-2026-89849 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...
CVE-2026-89848 scsi: qla2xxx: Quiesce response IRQ before freeing request queue
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Quiesce response IRQ before freeing request queue qla2xxxdeleteqpair deletes the request queue before the response queue. qla25xxdeletereqque frees the request queue memory kfreereq in qla25xxfreereqque, but the...
CVE-2026-89847 scsi: qla2xxx: Avoid double completion in async IOCB timeout
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00asynciocbtimeout tries to abort a timed-out async IOCB. When qla24xxasyncabortcmd fails, both the SRBLOGINCMD path and the SRBCTRLVP/default path scan...
CVE-2026-89846 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...
CVE-2026-89845 scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid reqqmap double-read in qla2x00errorentry qla2x00errorentry reads ha-reqqmapque twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xxfreereqque ha-reqqmapqueid =...
CVE-2026-89844 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...
CVE-2026-89843 scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak Several bsg handlers stage their request/reply in an uninitialized 256-byte on-stack buffer uint8t bsgDMAPOOLSIZE and fill it via sgcopytobuffer, which only copies as...
CVE-2026-89842 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qlanvmexmtlsrsp bails out to the out: label when firmware is not started !ha-flags.fwstarted, but the out: path unconditionally calls qlanvmelsrejectiocb, which ends in...
CVE-2026-89841 f2fs: only redirty pinned folios in redirty_blocks
In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...
CVE-2026-89840 f2fs: validate MOVE_RANGE destination size
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVERANGE destination size F2FSIOCMOVERANGE checks the source range, but not the destination end before updating isize. A source hole can expose this: cloneblkaddrs skips NULLADDR entries and returns success, so th...
CVE-2026-89839 f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fsxattradviseset f2fsxattradviseset calls inodeownerorcapable with &nopmntidmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to t...
CVE-2026-89838 f2fs: limit recovery filename logging to stored length
In the Linux kernel, the following vulnerability has been resolved: f2fs: limit recovery filename logging to stored length F2FS stores recovery filenames as a length plus a fixed-size iname buffer. The buffer is not NUL-terminated, but recoverinode and recoverdentry print it with %s. For a 255-by...
CVE-2026-89837 f2fs: fix dentry folio leak in find_in_level
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dentry folio leak in findinlevel findinlevel gets a dentry folio with f2fsfinddatafolio before calling findinblock. If findinblock returns an error, the function stores the error in resfolio and breaks out of the loop...
CVE-2026-89836 f2fs: fix folio_nr_pages() race after put in large folio invalidate
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix folionrpages race after put in large folio invalidate Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in1 which related to broken xarray slot status. By investigating big folio...
CVE-2026-89835 f2fs: avoid NULL checkpoint thread access in sysfs
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpointmerge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fsissueckpt there, but ckptthreadioprio is...
CVE-2026-89834 f2fs: fix to migrate all curseg types during free_segment_range
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange, the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE 0..5, missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNE...
CVE-2026-89833 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadloop in f2fsfsyncnodepages There is potential deadloop in race condition: Thread A Thread B - fsync - f2fsdosyncfile - f2fsfsyncnodepages - lastfsyncdnode - foliogetlastfolio - f2fssetattr -...
CVE-2026-89832 f2fs: fix to clear dirty flag on folio in error path
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage...
CVE-2026-89831 f2fs: protect critical_task_priority updates with s_umount
In the Linux kernel, the following vulnerability has been resolved: f2fs: protect criticaltaskpriority updates with sumount The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well. criticaltaskpriority also updates checkpoint or GC kthread...
CVE-2026-89830 f2fs: fix valid block count leak on data block allocation failure
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In allocatedatablock, when allocating a new data block dn-datablkaddr == NULLADDR, incvalidblockcount is called first to increment totalvalidblockcount and iblocks...
CVE-2026-89829 f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio-index to f2fssanitychecknodefooter Otherwise in f2fssanitychecknodefooter, it will check the same nid incorrectly...
CVE-2026-89828 drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...
CVE-2026-89827 drm/amdgpu: avoid force-completing uninitialized UVD rings
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid force-completing uninitialized UVD rings uvdv70swinit does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpuuvdresume unconditionally force-completes the decode ring when restoring its fence...
CVE-2026-89826 drm/panthor: harden firmware build-info bounds checks
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthorfwreadbuildinfo checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an...
CVE-2026-89825 drm/panthor: fix firmware control interface bounds checks
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthorinitcsiface and panthorinitcsgiface validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are...
CVE-2026-89824 drm/panel-edp: fix i2c adapter leak on probe failure
In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g. probe deferral and on driver unbind also if a devicetree redundantly uses the 'ddc-i2c-bus' property to point ...
CVE-2026-89823 drm: fix race between partial drm_dev_register() failure and ioctl
In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...
CVE-2026-89822 drm/i915: Guard against NULL driver_data in i915_pci_probe()
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driverdata in i915pciprobe pcimatchdevice can return the dummy pcideviceidany entry when a device is force-bound via sysfs driveroverride, in which case -driverdata is unset NULL. i915pciprobe casts i...
CVE-2026-89821 drm/amd/display: avoid divide-by-zero in __is_lut_linear()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid divide-by-zero in islutlinear islutlinear computes the expected value of each entry with expected = i MAXDRMLUTVALUE / size - 1; If it is ever called with a single-entry LUT, size - 1 is zero and the kernel...
CVE-2026-89820 drm/amd/display: fix dc_lock leak on GPU reset error paths
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix dclock leak on GPU reset error paths On GPU reset, dmsuspend takes dclock and leaves it for dmresume to drop. If amdgpudmcommitzerostreams or dmdmubhwinit fails, the function returns with the lock still held...
CVE-2026-89819 drm/amd/display: validate plane degamma LUT size for private color prop
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes, the per-plane degamma LUT size was never validated before use. setdmplanedegamma...
CVE-2026-89818 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg2 numbuffers is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of...
CVE-2026-89817 drm/gud: NUL-terminate TV mode names read from the device
In the Linux kernel, the following vulnerability has been resolved: drm/gud: NUL-terminate TV mode names read from the device gudconnectoraddtvmode reads a buffer of fixed-size mode names from the USB device and passes pointers into it to drmmodecreatetvpropertieslegacy, which calls strlen on eac...
CVE-2026-89816 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmcrtccommit leak if signaled when PAGEFLIPEVENT is used Commit 1c6ceeee6ebb "drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits" fixed a very similar issue when the event was allocated by...